0bf7383f263705d79654ba31e3906db133399c7559655a69159d1949d82d7e5f

Sharing

Copy URL Twitter E-mail

General

Target
0bf7383f263705d79654ba31e3906db133399c7559655a69159d1949d82d7e5f
Size 285KB
Sample261110-rbbceatzgx
SHA256 0bf7383f263705d79654ba31e3906db133399c7559655a69159d1949d82d7e5f
MD5 3829fc4e957fdd4b32d12a1306c47d5d
SHA1 d05a130a8fd7aa4f327a6c352877bd2b7cd8b771
SHA512 f795666b666f96db261642198f4586f588ebb1f3c93aa2d28d5bdbc6d4d0432232ddd70b30e853caa07faee0f99e11cbc968a8b9d5f6983c12fb74d4b57fde16
SSDEEP 3072:NbHHjcFHo13Hu6xDHj95S4cTItQdJEknx9Hj9:NbHjqAHuGj940CdJEk7j9
TLSH
T1A8548C9EFEC09C73D0152ABC8C07E285D5ADB5301E29C413FCAD0B4D9BB62B1A59E1D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0bf7383f263705d79654ba31e3906db133399c7559655a69159d1949d82d7e5f

File Explorer

0bf7383f263705d79654ba31e3906db133399c7559655a69159d1949d82d7e5f

.exe 285KB

0bf7383f263705d79654ba31e3906db133399c7559655a69159d1949d82d7e5f

IMPHASH debc396184f143c18c2ef30d2f69aa66
SHA256 0bf7383f263705d79654ba31e3906db133399c7559655a69159d1949d82d7e5f
MD5 3829fc4e957fdd4b32d12a1306c47d5d
SHA1 d05a130a8fd7aa4f327a6c352877bd2b7cd8b771
SHA512 f795666b666f96db261642198f4586f588ebb1f3c93aa2d28d5bdbc6d4d0432232ddd70b30e853caa07faee0f99e11cbc968a8b9d5f6983c12fb74d4b57fde16
SSDEEP 3072:NbHHjcFHo13Hu6xDHj95S4cTItQdJEknx9Hj9:NbHjqAHuGj940CdJEk7j9
TLSH
T1A8548C9EFEC09C73D0152ABC8C07E285D5ADB5301E29C413FCAD0B4D9BB62B1A59E1D9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56620

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CloseHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetVersion GetCurrentThreadId GetThreadLocale GetStartupInfoA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary ExitProcess WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA WriteProcessMemory WriteFile WinExec VirtualFreeEx VirtualAllocEx TerminateProcess SuspendThread SizeofResource SetThreadContext SetLastError SetFileTime SetFilePointer SetFileAttributesA SetEndOfFile ResumeThread ReadFile OpenProcess OpenFileMappingA MapViewOfFile LockResource LoadResource LoadLibraryA IsBadReadPtr GlobalFree GlobalAlloc GetWindowsDirectoryA GetVersionExA GetThreadContext GetTempPathA GetTempFileNameA GetSystemDirectoryA GetShortPathNameA GetProcAddress GetModuleHandleA GetLocalTime GetFileTime GetFileSize GetDriveTypeA GetCurrentProcessId GetCurrentProcess GetComputerNameA GetACP FreeResource FreeLibrary FindResourceA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime ExitProcess DuplicateHandle DeleteFileA CreateThread CreateProcessA CreateFileMappingA CreateFileA CopyFileA CompareStringA CloseHandle CloseHandle LoadLibraryA GetProcAddress

kernelbase

WideCharToMultiByte MultiByteToWideChar Sleep

user32

GetKeyboardType MessageBoxA CharNextA CreateWindowExA UpdateWindow TranslateMessage SendMessageA RegisterClassA PostThreadMessageA PostMessageA PeekMessageA LoadCursorA GetWindowTextA GetMessageA FindWindowExA FindWindowA DispatchMessageA DefWindowProcA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA RegCreateKeyExA RegCloseKey LookupAccountSidA LookupAccountNameA GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority FreeSid AllocateAndInitializeSid

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

mpr

WNetOpenEnumA WNetEnumResourceA WNetCloseEnum WNetCancelConnectionA WNetCancelConnection2A WNetAddConnection2A

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

winmm

waveOutSetVolume waveOutGetVolume

Sharing

General

Malware Config

Signatures

File Explorer

0bf7383f263705d79654ba31e3906db133399c7559655a69159d1949d82d7e5f

kernel32

kernelbase

user32

advapi32

oleaut32

mpr

version

wsock32

winmm

generic